# ELK stack Arcsight integration

**URL:** https://discuss.elastic.co/t/elk-stack-arcsight-integration/144340
**Category:** Kibana
**Created:** [August 14, 2018, 11:26am UTC](https://discuss.elastic.co/t/elk-stack-arcsight-integration/144340 "2018-08-14T11:26:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kd2004](https://avatars.discourse-cdn.com/v4/letter/k/ea5d25/32.png) [@kd2004](https://discuss.elastic.co/u/kd2004)
#### Post date: [August 14, 2018, 11:26am UTC](https://discuss.elastic.co/t/elk-stack-arcsight-integration/144340/1 "2018-08-14T11:26:47Z")

</div>

I am new in ArcSight ESM and want to integrate with ELK Stack using below

Link 1: [https://www.elastic.co/arcsight](https://www.elastic.co/arcsight)

Link 2: [https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-1](https://www.elastic.co/blog/integrating-elasticsearch-with-arcsight-siem-part-1)

Link 3: [https://www.edureka.co/blog/elk-stack-tutorial/](https://www.edureka.co/blog/elk-stack-tutorial/)

Link 4: [https://www.elastic.co/guide/en/logstash/6.x/arcsight-module.html](https://www.elastic.co/guide/en/logstash/6.x/arcsight-module.html)

While executing below commands getting the error.

bin/logstash --modules arcsight --setup  
-M "arcsight.var.elasticsearch.hosts=10.10.10.39:9200"  
-M "arcsight.var.kibana.host=10.10.10.39:5601"

[![](https://i.stack.imgur.com/PjQPk.jpg) ](https://i.stack.imgur.com/PjQPk.jpg)

Error: The request for this panel failed. The aggregations key is missing from the response

Please someone guide where is an issue.

Thanks in advance.

---

<div class="post-metadata">

### Author: ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)
#### Post date: [August 14, 2018, 5:49pm UTC](https://discuss.elastic.co/t/elk-stack-arcsight-integration/144340/2 "2018-08-14T17:49:29Z")

</div>

You may have better luck posting this over on our [Logstash forum](https://discuss.elastic.co/c/logstash). Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2018, 5:49pm UTC](https://discuss.elastic.co/t/elk-stack-arcsight-integration/144340/3 "2018-09-11T17:49:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.